is thre a way to run a single query against yara table with multiple sigfile's?
m
Mike Myers
01/14/2021, 12:20 AM
Yes, that should be possible
f
Faraz Jafri
01/14/2021, 11:31 AM
Have you tried using sig_group instead of sigfile?
You can add multiple files collectively in a group and run a query with that sig_group.
Though a group has to be defined in osquery.conf file.